Try fix release branch merge conflict by sync .github/workflows/spelling.yaml

.github/cspell.yaml

@@ -0,0 +1,6 @@
+version: '0.2'
+import:
+  - ../cspell.yaml
+words:
+  - azsdk
+  - pwsh

.github/workflows/SDK-Suppressions-Label.yaml

@@ -0,0 +1,108 @@
+name: SDK Suppressions
+
+on:
+  pull_request:
+    branches:
+      - main
+      - RPSaaSMaster
+      - release*
+
+permissions:
+  contents: read
+
+jobs:
+  process-sdk-suppressions-labels:
+    name: Sdk Suppressions
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          # Required since "HEAD^" is passed to Get-ChangedFiles
+          fetch-depth: 2
+
+      - name: Setup Node and run `npm ci`
+        uses: ./.github/actions/setup-node-npm-ci
+
+      - name: Get GitHub PullRequest Changed Files
+        shell: pwsh
+        id: get-changedFiles
+        run: |
+          . eng/scripts/ChangedFiles-Functions.ps1
+          $changedFiles = @(Get-ChangedFiles)
+          $changedFilesArray = $changedFiles -split ' '
+          $yamlFilesArray = $changedFilesArray | Where-Object { $_ -match 'sdk-suppressions\.yaml$' }
+          $yamlFiles = $yamlFilesArray -join ' '
+          echo "PR Changed sdk-suppressions.yaml files: $yamlFiles"
+          Add-Content -Path $env:GITHUB_OUTPUT -Value "changedFiles=$yamlFiles"
+
+      - name: Get GitHub PullRequest Context
+        uses: actions/github-script@v7
+        id: fetch-pullRequest-context
+        with:
+          script: |
+            const pr = context.payload.pull_request;
+            if (!pr) {
+              throw new Error("This workflow must run in the context of a pull request.");
+            }
+            console.log("This action trigger by ", context.eventName);
+            core.setOutput("prLabels", pr.labels.map(label => label.name));
+          result-encoding: string
+
+      - name: Run Get suppressions label script
+        id: run-suppressions-script
+        env:
+          OUTPUT_FILE: "output.json"
+          GITHUB_PULL_REQUEST_CHANGE_FILES: ${{ steps.get-changedFiles.outputs.changedFiles }}
+          GITHUB_PULL_REQUEST_LABELS: ${{ steps.fetch-pullRequest-context.outputs.prLabels }}
+        run: |
+          node eng/tools/sdk-suppressions/cmd/sdk-suppressions-label.js HEAD^ HEAD "$GITHUB_PULL_REQUEST_CHANGE_FILES" "$GITHUB_PULL_REQUEST_LABELS"
+
+          OUTPUT=$(cat $OUTPUT_FILE)
+          echo "Script output labels: $OUTPUT"
+
+          labelsToAdd=$(echo "$OUTPUT" | sed -n 's/.*"labelsToAdd":\[\([^]]*\)\].*/\1/p' | tr -d '" ')
+          labelsToRemove=$(echo "$OUTPUT" | sed -n 's/.*"labelsToRemove":\[\([^]]*\)\].*/\1/p' | tr -d '" ')
+
+          for label in $(echo $labelsToAdd | tr ',' '\n'); do
+            echo "Label to add: $label"
+            echo "$label=true" >> $GITHUB_OUTPUT
+          done
+
+          for label in $(echo $labelsToRemove | tr ',' '\n'); do
+            echo "Label to remove: $label"
+            echo "$label=false" >> $GITHUB_OUTPUT
+          done
+
+      # No Action or Add/Remove label ​​according to step run-suppressions-script output
+      # e.g.
+      #     If the output of the step does not include the BreakingChange-Go-Sdk-Suppression, no action will be taken.
+      #     If the step's output is "BreakingChange-Go-Sdk-Suppression='true'", the label "BreakingChange-Go-Sdk-Suppression" will be applied to the PR.
+      #     If the step's output is "BreakingChange-Go-Sdk-Suppression='false'", the label "BreakingChange-Go-Sdk-Suppression" will be removed from the PR.
+      - uses: ./.github/actions/add-label-artifact
+        name: Upload artifact with results-go
+        if: ${{ steps.run-suppressions-script.outputs.BreakingChange-Go-Sdk-Suppression }}
+        with:
+          name: "BreakingChange-Go-Sdk-Suppression"
+          value: "${{ steps.run-suppressions-script.outputs.BreakingChange-Go-Sdk-Suppression == 'true' }}"
+
+      - uses: ./.github/actions/add-label-artifact
+        name: Upload artifact with results java
+        if: ${{ steps.run-suppressions-script.outputs.BreakingChange-Java-Sdk-Suppression }}
+        with:
+          name: "BreakingChange-Java-Sdk-Suppression"
+          value: "${{ steps.run-suppressions-script.outputs.BreakingChange-Java-Sdk-Suppression == 'true' }}"
+
+      - uses: ./.github/actions/add-label-artifact
+        name: Upload artifact with results js
+        if: ${{ steps.run-suppressions-script.outputs.BreakingChange-JavaScript-Sdk-Suppression }}
+        with:
+          name: "BreakingChange-JavaScript-Sdk-Suppression"
+          value: "${{ steps.run-suppressions-script.outputs.BreakingChange-JavaScript-Sdk-Suppression == 'true' }}"
+
+      - uses: ./.github/actions/add-label-artifact
+        name: Upload artifact with results python
+        if: ${{ steps.run-suppressions-script.outputs.BreakingChange-Python-Sdk-Suppression }}
+        with:
+          name: "BreakingChange-Python-Sdk-Suppression"
+          value: "${{ steps.run-suppressions-script.outputs.BreakingChange-Python-Sdk-Suppression == 'true' }}"

.github/workflows/_reusable-eng-tools-test.yaml

@@ -20,19 +20,22 @@ on:
         required: false
         type: boolean
 
+permissions:
+  contents: read
+
 jobs:
   test:
     strategy:
       matrix:
-        os: [ubuntu-latest, windows-latest]
-        node-version: [18, 20]
+        os: [ubuntu, windows]
+        node-version: [18, 22]
         exclude:
-          - os: ubuntu-latest
-            node-version: 20
-          - os: windows-latest
+          - os: ubuntu
+            node-version: 22
+          - os: windows
             node-version: 18
 
-    runs-on: ${{ matrix.os }}
+    runs-on: ${{ fromJSON('{"ubuntu":"ubuntu-24.04", "windows":"windows-2022"}')[matrix.os] }}
 
     steps:
       - if: runner.os == 'Windows'
@@ -63,7 +66,7 @@ jobs:
       - run: npm run prettier
         if: inputs.prettier == true
         shell: pwsh
-        working-directory: ./eng/tools/${{ inputs.package }}        
+        working-directory: ./eng/tools/${{ inputs.package }}
 
       - run: npm run test:ci
         shell: pwsh

.github/workflows/github-test.yaml

@@ -0,0 +1,48 @@
+name: GitHub Actions - Test
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - .github/**
+  pull_request:
+    paths:
+      - .github/**
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+    working-directory: ./.github
+
+jobs:
+  test:
+    runs-on: ubuntu-24.04
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            .github
+
+      - name: Setup Node 20 and install deps
+        uses: ./.github/actions/setup-node-install-deps
+        with:
+          # actions/github-script@v7 uses Node 20
+          node-version: 20.x
+          working-directory: ./.github
+
+      - name: Run tests
+        run: npm run test:ci
+
+      - name: Archive code coverage results
+        uses: actions/upload-artifact@v4
+        with:
+          name: code-coverage-report
+          path: ./.github/coverage
+          if-no-files-found: ignore

.github/workflows/protected-files.yaml

@@ -2,6 +2,9 @@ name: Protected Files
 
 on: pull_request
 
+permissions:
+  contents: read
+
 env:
   # Users allowed to edit protected files without failing check
   user-allowed: ${{ github.event.pull_request.user.login == 'azure-sdk' }}
@@ -10,7 +13,7 @@ jobs:
   protected-files:
     name: Protected Files
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       # Since check is required, the job must pass instead of being skipped

.github/workflows/specs-model-test.yaml

@@ -17,6 +17,9 @@ on:
       - eng/tools/specs-model/**
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   specsModel:
     name: Specs Model

.github/workflows/spelling-all.yaml

@@ -0,0 +1,34 @@
+name: SpellCheck - All
+
+on:
+  push:
+    branches:
+      - main
+      - RPSaaSMaster
+
+  schedule:
+    # Run every day at 12:06 UTC
+    - cron: "6 12 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  spellcheck:
+    name: SpellCheck
+    runs-on: ubuntu-24.04
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Run spelling check
+        run: |
+          ./eng/common/spelling/Invoke-Cspell.ps1 `
+            -ScanGlobs '**' `
+            -CSpellConfigPath './cspell.json' `
+            -SpellCheckRoot (Resolve-Path specification)
+        shell: pwsh

.github/workflows/spelling.yaml

@@ -2,10 +2,13 @@ name: SpellCheck
 
 on: pull_request
 
+permissions:
+  contents: read
+
 jobs:
   spellcheck:
     name: SpellCheck
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - name: Checkout repository
@@ -16,9 +19,10 @@ jobs:
       - name: Run spelling check
         run: |
           ./eng/common/scripts/check-spelling-in-changed-files.ps1 `
-              -CSpellConfigPath 'cSpell.json' `
+              -CSpellConfigPath 'cspell.json' `
               -SourceCommittish HEAD `
               -TargetCommittish HEAD^ `
+              -SpellCheckRoot (Resolve-Path specification) `
               -ExitWithError
           if ($LASTEXITCODE) {
             Write-Host "Spelling errors found in changed files. See https://aka.ms/ci-fix#spell-check"

.github/workflows/suppressions-test.yaml

@@ -17,6 +17,9 @@ on:
       - eng/tools/suppressions/**
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   suppressions:
     uses: ./.github/workflows/_reusable-eng-tools-test.yaml

.github/workflows/tsp-client-test.yaml

@@ -21,6 +21,9 @@ on:
       - specification/sphere
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   tsp-client:
     uses: ./.github/workflows/_reusable-eng-tools-test.yaml

.github/workflows/typespec-requirement-test.yaml

@@ -17,6 +17,9 @@ on:
       - eng/tools/typespec-requirement/**
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   typespec-requirement:
     uses: ./.github/workflows/_reusable-eng-tools-test.yaml

.github/workflows/typespec-requirement.yaml

@@ -2,15 +2,14 @@ name: TypeSpec Requirement
 
 on: pull_request
 
+permissions:
+  contents: read
+
 jobs:
   TypeSpec-Requirement:
     name: TypeSpec Requirement
-    strategy:
-      fail-fast: false
-      matrix:
-        spec-type: [data-plane, resource-manager]
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - uses: actions/checkout@v4
@@ -25,5 +24,12 @@ jobs:
           eng/scripts/TypeSpec-Requirement.ps1 `
             -BaseCommitish HEAD^ `
             -TargetCommitish HEAD `
-            -SpecType ${{ matrix.spec-type }}
+        id: tsr-ps1
         shell: pwsh
+
+      # Always add label artifact, even if "brownfield=false", to ensure label is removed when necessary
+      - uses: ./.github/actions/add-label-artifact
+        name: Upload artifact with results
+        with:
+          name: "brownfield"
+          value: "${{ steps.tsr-ps1.outputs.brownfield == 'true' }}"

.github/workflows/typespec-validation-all.yaml

@@ -28,10 +28,13 @@ on:
 
   schedule:
     # Run 4x/day
-    - cron: '0 0,6,12,18 * * *'
+    - cron: "0 0,6,12,18 * * *"
 
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   typespec-validation-all:
     # Use short name to maximize space for parameters in UI
@@ -53,7 +56,7 @@ jobs:
         # total-shards must be an accurate count of the number of shards
         total-shards: [3]
 
-    runs-on: ${{ matrix.os }}-latest
+    runs-on: ${{ fromJSON('{"ubuntu":"ubuntu-24.04", "windows":"windows-2022"}')[matrix.os] }}
 
     steps:
       - name: Enable git long paths
@@ -67,7 +70,7 @@ jobs:
 
       - name: Setup Node and run `npm ci`
         uses: ./.github/actions/setup-node-npm-ci
-        
+
       - name: Validate All Specs
         run: |
           # Keep processing when errors are written. Nonzero exit will mark the